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Abstract We propose a novel upconversion (sum frequency generation) based 
quantum-optical setup that can be employed as a receiver (Bob) in practical 
quantum key distribution systems. The pump governing the upconversion pro¬ 
cess is produced and utilized inside the physical receiver, making its access or 
control unrealistic for an external adversary (Eve). This pump facilitates sev¬ 
eral properties which permit Bob to define and control the modes that can 
participate in the quantum measurement. Furthermore, by manipulating and 
monitoring the characteristics of the pump pulses. Bob can detect a wide range 
of quantum hacking attacks launched by Eve. 

Keywords upconversion • quantum hacking • secure quantum key distribu¬ 
tion • quantum frequency conversion • faked-state attacks 


1 Introduction 

The process of upconversion of light denotes a nonlinear interaction in which 
two optical frequencies wi and uj2 add together to generate optical radiation 
at a third frequency = uJi + lo2- It was first observed in lithium niobate 
almost half a century ago . A quantum-mechanical treatment of such 
frequency conversion processes suggested that the quantum features of one 
of the input light beams, usually called ‘signal’, could be preserved during 
the nonlinear interaction. This has now been confirmed in numerous exper¬ 
iments [^ 1 ^ dealing with frequency upconversion of quantum-optical states, 
e.g. entangled states, weak coherent states. 

A majority of upconversion experiments aim to convert optical signals in 
the near-infrared regime to those in the visible or near-visible regime, where 


N. Jain • G.S. Kanter 

Department of Electrical Engineering and Computer Science, 

2145 Sheridan Road, Northwestern University, Evanston IL 60208-3118 
E-mail: nitin.jain@northwestern.edu 





2 


Nitin Jain, Gregory S. Kanter 


highly-efficient and low-noise detectors are easily available. Improvements in 
upconversion devices [&■ 11 and novel approaches, such as the quantum pulse 


gate 


12 and mode resolving detection enabled by optical arbitrary waveform 
offer the possibility of high-dimensional communication 


13,14 


generation 

with large throughputs. With help of photonic quantum information inter¬ 
faces 15 , the prospects of realistic quantum communication networks 16 17 


become more promising. 

Quantum key distribution (QKD) is certainly one area that can benefit 
from the aforementioned advances. Briefly, QKD is a cryptographic method 
that facilitates two users Alice (sender) and Bob (receiver) to obtain sym¬ 
metric keys that can then be used for encrypting messages in an information- 
theoretically secure manner 18-^. An adversary Eve attempting to eaves¬ 


drop on the key exchange induces errors that can be detected by Alice and 
Bob, thus alerting them and preventing the loss of confidentiality of their 
encrypted messages. 

In the last decades, QKD has evolved to become the foremost applica¬ 
tion of quantum information technology. Upconversion technology has already 
been successfully demonstrated for a variety of QKD systems [^[^, including 
implementations of differential phase shift |211|22l and measurement-device- 


independent (MDI) protocols @ 0 . With features such as low jitter and 
inherent polarization sensitivity [25| in addition to the improved detection ef¬ 
ficiency (via Si avalanche photodiodes), upconversion-assisted detectors have 
been instrumental in pushing up the secret key rates in practical QKD. 

The theoretical security model of QKD, which fundamentally utilizes the 
laws of quantum mechanics, offers provably secure key exchange. In practice 
however, imperfections and limitations of the physical hardware can open se¬ 
curity loopholes that can be exploited by Eve to attack the QKD system and 
obtain knowledge of the key without alerting Alice and Bob 20 26 27 . Such 


attacks are popularly referred to as quantum hacking 28 


A majority of quantum hacking attempts demonstrated in the last years 
involved Eve actively injecting optical pulses into the QKD receiver to exploit 
imperfections such as timing related issues in the detection apparatus. The in¬ 
tensity of these pulses (sometimes accompanied with CW power ranging from 
less than 1 mW to a few Watts) ranged from that of dim coherent states con¬ 


taining 10 —100s of photons to bright pulses having millions of photons 29 -36 


In most cases, while the wavelength of Eve’s light was the same as that used by 
Alice and Bob, i.e. the telecom wavelength of ~ 1550 nm, a few eavesdropping 
strategies have also been explored at different wavelengths [37[j3^ . 

In this paper, we propose an upconversion protected (UCP) receiver that 
would fortify practical QKD against a wide range of quantum hacking at¬ 
tacks 40 . The design of the UCP-QKD receiver employs off-the-shelf optical 


and optoelectronic components and its operation is simple. The design also 
obviates the usual difficulties in trying to analyze (the security of) a QKD 
system where every component is evaluated over a huge range of variables 
such as wavelength, time, etc. The resulting boost in security improves the 
overall performance of a non-cryogenically cooled QKD system since higher 
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a) nonlinear (depleted) b) 


generation (SFG) signal 

Fig. 1 (Color online) Basic upconversion device and quantum key distribution receiver 
schemes, a) The upconversion takes place inside the nonlinear medium when the pump 
and signal modes overlap as prescribed by the phase-matching conditions. The resulting 
upconverted/SFG photons inherit the quantum properties of the signal, b) Generic QKD 
receiver used by Bob to interferometrically detect quantum states coded in phase and time by 
Alice and sent over the quantum channel. AMZI: asymmetric Mach Zehnder interferometer, 
PM: phase modulator, DO/1: single photon detectors. 



medium pump . ^ 


sum frequency 
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quality semiconductor (Silicon) based single photon detectors are employed. 
Therefore, even though we are of the opinion that no cryptographic system 
- quantum or classical - can be guaranteed to be unconditionally secure, the 
proposed receiver has some desirable properties that enhance the security and 
performance of practical QKD. In that sense, our work significantly adds to 
the advantages of upconversion technology for practical QKD systems. It also 
joins the growing body of countermeasures 41,42 and novel schemes, such as 
MDI-QKD [^, conceived in order to heal the Achilles’ heel of QKD 43 : the 


(vulnerable) photon detection system, without compromising on performance. 

The organization of the paper is as follows: in section we present the 
basic principles on which the security provided by the UCP-QKD receiver is 
based. We also propose a prototype, explaining its design, operation, and the 
implementation of the security features in detail. In section thereafter, we 
discuss how the prototyped receiver provides protection against three classes of 
attacks. After discussing some practical aspects in section]^ to showcase that 
the performance of the UCP-QKD receiver is comparable to state-of-the-art 
QKD implementations, we conclude in section 


2 Upconversion based QKD receivers 

Figure shows the main idea of upconversion. A strong classical ‘pump’ field 
at wavelength Apump interacts with a ‘signal’ field at wavelength Asig inside 
a medium, e.g. a nonlinear waveguide, for the sum frequency generation 
(SFG) process. The ‘upconverted/sum’ radiation is at the wavelength Asum = 

(pA- 1 _ T^) and can be shown to preserve the quantum statistics of the 

signal field. This is due to the fact that the field operators of the signal and 
upconverted modes simply transform into each other (neglecting an overall 
phase factor) at an appropriate pump amplitude [2j|^. 

In order to implement quantum communication systems with upconversion 
devices, two useful figures of merit are the efficiency rj = fjcTjd and the (dark) 
noise level in the measurement of the SFG light. Here, rjc essentially indicates 
the probability to convert the wavelength of a signal photon from Asig to Asum 
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in the nonlinear process, while rjd is the probability to then detect that sin¬ 
gle photon. Note that any practically-useful definition of rjc would include the 
waveguide’s non-unity transmission, due to coupling and propagation losses in 
the nonlinear medium. The noise includes the intrinsic dark counts of the de¬ 
tector and those due to parasitic nonlinear interactions, such as pump-induced 
parametric fluorescence and spontaneous Raman scattering 10 44 . Based on 


the typical values of rjc and rjd reported in numerous experiments, achieving 
77 ~ 40% at a dark count probability below 10“® per signal pulse should be 
feasible with commercially available detectors 10 . Receivers utilizing up- 
conversion technology can therefore surpass the performance of those detecting 
photons directly at telecom wavelengths (using non-cryogenic detectors) . 


2.1 Building blocks 


Figure shows a generic time-multiplexed interferometric scheme 46 that 
is at the heart of several practical QKD receiver setups (both prepare-and- 
measure and entangled-based type) 1^ -50 . The photon is in a superposition 
of the two optical modes, temporally separated by 6T, that form the basis of 
the qubit space and are used for encoding of the bits “0” and “1”. This quantum 
signal, sent over the quantum channel, is received and decoded in an asymmet¬ 
ric Mach Zehnder interferometer (AMZI) that consists of a phase modulator 
(PM) and a pair of single photon detectors (DO and Dl). The PM is used for 
active basis selection in prepare-and-measure systems and for adjusting the 
interferometer to maintain the correlations between pairs of detectors across 
the receivers of Alice and Bob in entangled-based systems. Unless mentioned 
explicitly, we will be referring to prepare-and-measure systems only. 

Integration of the upconversion device shown in Fig. in such a QKD 
receiver requires the quantum states received over the quantum channel (as¬ 
sumed to be in control of Eve) to be upconverted by the pump before the 
detection stage. Guaranteeing secure operation then implies that the detec¬ 
tion and basis selection apparatus in Bob must be isolated from the external 
influences of Eve. More specifically. Eve’s injection from the channel into the 
receiver must be restricted in wavelength, time, and power. In the following, 
we describe several properties - intrinsic to upconversion devices - that facili¬ 
tate achieving such an objective. The building blocks of the secure UCP-QKD 
receiver are thus based on the proper implementation of these properties. 


Linear wavelength isolation (LWI) 

An upconversion system can be designed so that no optical wavelength lin¬ 
early propagates through the system. In other words, only light generated by 
a specified local nonlinear interaction will reach the detection apparatus in 
the receiver. Such linear wavelength isolation (LWI) can be achieved simply 
by using optical filters, such as a band pass filter (BPF) which lets through 
light at wavelengths only inside a certain band. As an instance, although Eve 
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can inject as much power as desired at the signal wavelength, without the 
SFG interaction, an ideal BPF with central wavelength Asum would block the 
injected light from reaching the detector^ With a carefully-chosen width, the 
BPF will also be effective in blocking the harmonics (Asig/n, where n > 2 is an 
integer) that may get generated due to poorly phase-matched nonlinearities. 
A short pass filter (SPF) that cuts off any light at wavelengths above a speci¬ 
fied wavelength could also be employed, for example to block Eve’s radiation 
at Apump from the quantum channel. This prevents Eve from controlling the 
nonlinear conversion process herself. Thus, only the frequencies converted via 
a specified nonlinear interaction eventually reach the detector while all oth¬ 
ers are suppressed. The detectors are then effectively isolated - in the linear 
regime - at all optical wavelengths injected at the input of the receiver. (In 
general, by using an appropriate combination of optical filters before and after 
the waveguide, any leakage can also be ensured to be negligible). The LWI 
property thus heavily curtails the wavelength degree of freedom for Eve. 


Optical gating (OG) 

In the so-called gated mode operation of a detector, e.g. single photon avalanche 
diode (SPAD), an electronically-applied gate raises the diode’s sensitivity to 
obtain a measurable response to even single photons in a short temporal win¬ 
dow. In an upconversion device, the nonlinear interaction inside the waveg¬ 
uide can happen only in the presence of the pump pulse. This allows us to 
correspondingly define a gate of width Tgate where detection events can be 
recorded, thereby restricting Eve’s exploitation via the temporal degrees of 
freedom. However, the definition of Tgate is strongly dependent on the extinc¬ 
tion ratio ER achieved in the production of the pump pulses. In an ideal case 
with infinite ER, as depicted in Fig. it is clear that only signals having 
an overlap with the pump pulse would undergo the nonlinear conversion. At 
the other extreme, a poor ER (translating into a relatively-large background 
level, as shown in Fig. [^) combined with pulse jitter can force Tgate to be 
much wider than Tpump- This may be exploited by Eve, e.g., through bright 
faked states arriving slightly shifted away from the pump peak, as we shall 
explain later. The extinction ratio must therefore be large enough to exclude 
the possibility of these type of attacks, as depicted by pulse (ii) in Fig. H- Fi¬ 
nally, the pump in fact may also act as a gate in the wavelength regime if the 
frequency conversion process is phase-matched only for one signal wavelength. 


Power limiting and monitoring (PLM) 

The amount of optical power entering any QKD receiver can both be lim¬ 
ited and monitored, e.g. by using appropriate combinations of passive and 

^ Security concerns arising from nonlinear interactions in the waveguide, especially the 
conversion of photons injected by Eve at the signal wavelength after interacting with Bob’s 
pump, will be examined in the next subsections. 
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Fig. 2 (Color online) Illustration of the power limiting and monitoring (PLM) and optical 
gating (OG) properties. (Assume the y-axis with a logarithmic scale). The pump pulse 
defines an optical gate where upconversion can happen, a) For an ideal pulse, Tgate ~ T-pump 
holds. With just the quantum signal, the undepleted (dashed border) and depleted pump 
pulses coincide, b) In case of poor extinction however, the pump-pulse specified gate is 
either ill-defined or too wide; Tgate >> Tpump. Eve may then escape the monitoring system 
by shifting the strong pulse to upconvert pump background photons, c) Many of Eve’s 
attacks in which she replaces the quantum signals with strong pulses, for instance, those 
labeled (i) or (ii), can be defeated if the pump pulses can be produced with reasonable 
extinction (rgate <1 Tpump) and their depletion can be monitored with high resolution. 


active optical components. Recently however, vulnerabilities in such counter¬ 
measures were reported 39 . For an upconversion device, the limiting function 
is available in a fundamental sense: the photon flux of the upconverted pulses 
is upper bound by the photon flux of the pump pulses. Moreover, a powerful 
pulse in the signal mode, as shown by pulse (i) in Fig. [^, would lead to a 
depletion of the pump at the output of the waveguide. To elaborate, let us 
denote the peak pump power measured at the input [output] of the waveguide 
by Pin [Pout] in the absence of the signal (so that the ratio Pout/Pin indi¬ 
cates the true optical loss through the waveguide). Bob could then monitor 
the actual power Pouti in the presence of a signal. Any noticeable depletion of 
the pump would indicate a bright pulse with multiple photons - likely from 
Eve’s injection. In a quantitative sense, any unusual fluctuations of the quan¬ 
tity C = |1 — Pouti/Pout] could be used for raising alarm and alerting Alice. 
Remarkably, this monitoring provides a zero insertion loss method to locate 
signatures of potential attacks. The pump parameters and the resolution of 
the monitoring system are critical to the success of the power limiting and 
monitoring (PLM) property. Note that it is also possible to losslessly monitor 
light at the signal wavelength, which further enhances the ability of Bob to 
discover unwanted signals injected by Eve. 


Nonlinear application of basis choice (NABC) 


The SFG signal has a phase that is the combination of both the signal and 
pump phases 51 . This opens up the possibility of selecting the basis for the 


signal in a nonlinear fashion by randomly modulating the pump phase during 
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pump monitor (out) 



Fig. 3 (Color online) Schematic of the UCP-QKD receiver. The description and role of the 
various filters, such as BPFsig, is given in the text. The AMZI in the pump path is not 
shown for the sake of clarity. It will be discussed later; see Fig. [^for instance. Using a DM, 
the pump and signal paths (dotted and solid lines) are overlapped before the waveguide. 
Similarly, the SFG (dashed line) is separated from the other waves after the waveguide. The 
DMjJq] at the input [output] of the waveguide must be chosen to be highly transmissive at 
the signal[sum] wavelength. After passing through another AMZI, the upconverted photons 
at Aaum are detected by the single photon detectors DO and D1 (dashed line). Although 
not shown, the pump power is monitored before the waveguide as well. AMZI: asymmetric 
Mach Zehnder interferometer, B/SPF: Band/Short pass filter, DM: dichroic mirror 


the upconversion process. Notably, this kind of basis selection can be per¬ 
formed actively and is essentially loss-less for the signal. A straightforward 
security advantage of NABC is that Eve cannot access this nonlinear phase 
shift. Furthermore, selecting the basis using the pump alone implies the iso¬ 
lation of Bob’s basis selection apparatus from Eve without using any special 
components such as optical isolators. This of course is subject to how well the 
pump path can be insulated from Eve. As we shall describe later in detail, 
the chances of accessing the secret basis choice remotely from the quantum 
channel by means of sending bright pulses and analysing back-reflections can 
be made negligible 38 52 . Additionally Bob can use the NABC property to 


detect the presence of injected pulses from Eve, such as faked states. 


2.2 System design and operation 


The design and operation of a generic upconversion QKD receiver which is 
secure against a host of quantum hacking attacks is governed by the above 
properties. In a QKD system that implements these properties correctly. Bob 
can both define and control the modes that participate in the quantum mea¬ 
surement, which ultimately decides the exchanged key. 

Figure shows an exemplary schematic of the UCP-QKD receiver based 
on the time-multiplexed interferometric scheme discussed in Fig.^. Below we 
describe the various components and their roles; unless mentioned otherwise, 
we shall always refer to the operation of phase-coded BB84 protocol [T^ . 

For the nonlinear material, we consider a periodically poled lithium nio- 
bate (PPLN) waveguide for this example. Pump pulses are generated using 
a pulsed laser source at wavelength Apump ~ 1810 nm; the choice of this long 


wavelength pump is guided by decreased noise in the upconversion process 10 . 
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Every cycle, a pair of pump pulses interact - in the PPLN waveguide - with 
a pair of signal pulses (wavelength: Asig « 1530 nm) arriving from the quan¬ 
tum channel. The pulses in a pair are separated by time 8T and to ensure a 
high efficiency of upconversion, the pump pulse width Tpump is chosen so that 
it encompasses the signal during the nonlinear interaction (rgig < Tpump)- To 
minimize transmission losses, anti-reflection coatings at Asig[Asum] can mini¬ 
mize the in[out]-coupling losses of the waveguide. 

The upconverted modes at Agum ~ 830 nm are subsequently decoded in 
the asymmetric Mach Zehnder interferometer (AMZI) by reversing the delay 
5T. It can be seen that the time windows/bins of detection are defined by 
the pump pulses: detection events in one of three different output time bins 
labeled early, middle, and late are obtained every cycle. The relative phase 
of the upconverted modes, which determines the interference outcomes in the 
middle time bin, is controlled by the transfer of the phase of the pump pulses 
onto signal pulses during upconversion. Therefore the AMZI just before the 
detectors includes only a time delay. The outcomes are recorded via the detec¬ 
tion clicks of Si-based single photon avalanche diodes (SPADs) that exhibit a 
high quantum efficiency around Agum and operate in the free-running mode. 


Implementation of LWI 


The coiled fiber at the entrance of the QKD receiver shown in Fig. [^essentially 
serves as a short pass Alter (SPF)|^ The radius of the coil is chosen such that 
the SPF cutoff wavelength is < 1800 nm. This would have a minimal impact 
on the signal photons at Agig « 1530 nm and simultaneously prevent Eve from 
injecting her own pump at long(er) wavelengths. Together with the PPLN 
waveguide, featuring a transparency window that starts around 350 nm, the 
pertinent wavelength range for any attack could then be roughly narrowed 
down to 300 — 1850 nm. 

Using a dichroic mirror (DM) before/after the PPLN (see Fig.[^ facilitates 
in combining/separating the pump from the signal/upconverted photons. De¬ 
pending on the dichroic Alter type, the practical implementation may work in 


the reflecting or transmitting mode 53 ^. Note that if an all-flber-integrated 
assembly is employed 55 56 , wavelength division multiplexers can be used 
instead of the dichroic mirrors. The short pass Alter SPFgig after the waveg¬ 
uide cuts off the infrared pump and signal wavelengths while allowing the 
upconverted photons to pass through to the detectors. Together with the two 


band pass Alters BPFgjg and BPFg 


centered at Agig and Ag 


respectively. 


it plays an essential role in implementing LWI in the receiver. In other words, 
this assembly ensures that light at all wavelengths injected from the quantum 
channel are suppressed before the SPDs except for the photons upconverted 
from Agig to Agum by Bob’s pump pulses. 

Figure [^ sums up the contribution of the different optical elements that 
realizes LWI in the receiver. Several commercial DMs, SPFs, and BPFs that can 


^ Alternatively, an appropriate filter can be used, but a coiled fiber offers a lower loss and 
cost-effective solution. 
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Fig. 4 (Color online) Linear wavelength isolation in the QKD receiver shown in Fig. Any 
wavelength - chosen by Eve to attack — corresponds to a horizontal line in this chart. It is 
possible to engineer that any wavelength encounters heavy losses (> 60 dB) before reaching 
the SPDs. The gradient values for the different components here are illustrative. The widths 
Zlsig and /Isum of the band pass filters BPFsig and BPFsum centered at Asig and Asum are 
not more than a few tens of nm; this choice does not affect the overall receiver efficiency. 


be used here are available in both free-space and fiber-optic versions 57 -59 


Also, two filters of the same kind could be cascaded to provide even higher 
optical density in the 300 — 1850 nm wavelength range. In fact, one could also 
get rid of the SPFs and just use a series of BPFgig [BPFsum] before [after] the 
waveguide - provided sufficient isolation in the aforementioned wavelength 
range (with the exception of Asig and Asum) is achievable. 

It is very important that the net filtering greatly attenuate an input at the 
phase-matched pump wavelength. This ensures that Eve cannot inject a large 
pump ~ together with signal of appropriate power level ~ that allows her to 
have control over the nonlinear interaction and circumvent the power limit¬ 
ing and LWI properties of the system. Given the large wavelength separation 


between the pump and signal (Ap 


-As 


300nm), ultra-high pump at¬ 


tenuation with low signal loss should be possible. We estimate that ~ 80 dB of 
isolation (which is quite easy to obtain because of the dichroic mirror) until the 
waveguide at Apump would be sufficient. This would ensure that the power of 
Eve’s injected pump is < 100 nW inside the waveguide, and the corresponding 
upconverted light is too dim to be useful for any known attack^] 


Implementation of PLM and OG 

To implement PLM, the residual pump (after the nonlinear interaction) is 
diverted to a monitoring stage where its depletion is recorded. A high res¬ 
olution monitoring system would catch classical optical pulses injected by 

® We assume that the optical fibers in front of the receiver would readily fuse, disconnect¬ 
ing the receiver from the quantum channel, for > lOW average input powers [42|. 
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Fig. 5 (Color online) Monitoring of the pump Sz signal and nonlinear phase transfer between 
them. Relative power measurements before and after the waveguide by pump monitors (in) 
and (out), respectively, can indicate even minor depletions. The depleted signal (solid red 
line after prism) can be optionally monitored with a suitably-sensitive detector that would 
register detection events during attacks. The relative phase modulated on the pump is 
transferred onto the signal during the nonlinear interaction. A prerequisite to implementing 
such basis selection is the calibration of the modulation voltages at Apump to ensure correct 
measurement of the QKD protocol alphabet with the upconverted photons. 


Eve in the signal mode, as was shown in Fig. H- If Cmin denotes the mini¬ 
mum resolution of the monitoring system and Pout denotes the pump peak 
power at the output of the waveguide in normal circumstances, peak pow¬ 
ers as low as CminroutApumpipump/AsigTsig of pulses Substituted by Eve in the 
signal mode could be caught. Taking realistic pump and signal parameters 
of Pout = 100 mW, Tpump = 100 ps and Tgig = 80 ps, and Cmin = 0.1%, Eve’s 
pulses with peak powers above 150 fiW [29||3lp2p0] would result in alarm and 
foil the attack. Such high resolution monitoring can be performed by recording 
the pump power both before and after the waveguide, as illustrated in Fig. 
The pulse monitoring could actually be taken one step further by also mon¬ 
itoring light at the signal wavelength. This could be done by adding a prism 
in the pump monitoring arm, as shown in Fig. Nothing would be registered 
on this monitor in case of a legitimate quantum signal, however. Eve’s large 
injections around Asig would get caught due to insufficient depletion. Notably, 
this is again a loss-less method to check for attacks. 


In order to implement OG securely, we believe ER values of at least —30 dB 
would be required. Consider a situation similar to the one depicted in Fig. H 
with Tgate ~ 2rpump- Such a large gate width may be practically necessary to 
minimize the effect of jitter, etc. Reusing the numerical values of the example 
in the previous paragraph, a bright faked state timed to arrive just after the 
pump-pulse peak (like pulse (ii) in the figure, but just inside Tgate) avails at 
the most Pout/lOOO ~ 100/iW of power from the pump. Even assuming full 
upconversion, or rjc = 100%, the peak power of the pulses generated at Agum 
and hitting Bob’s SPDs cannot exceed Agig/Asum x 100 ~ 185 ^W, which is 
again well below the typical peak powers used in faked-state attack^ 


In fact, using the formula for conversion efficiency the actual r]c < 1% and with 

propagation losses around 3dB, the peak power on the detectors would be < 1 fiW. 
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To reduce even further the chances of security breach from Eve’s attack 
pulses outside the pump pulse, one can also randomly modulate the phase 
modulator (PM) between pump pulses. This would defeat the detector control 
strategy due to randomization of the detection outcomes in DO and Dl. In 
that sense, the impact of a poor ER can also be mitigated. 


Implementation of NABC 


Figure shows a simple scheme that demonstrates the preparation of the 
pump pulses by using an AMZI in the pump arm; also see Fig.[^ This scheme 
also illustrates the nonlinear application of basis choice (NABC), some aspects 
of which have already been covered. In particular, using a dichroic mirror to 
combine the pump and signal can be quite effective in isolating the pump path 
from the quantum channel. As explained previously, this successfully prevents 


Eve from obtaining back-reflections, e.g. via Trojan-horse attacks 38 39 52 
that may divulge the secret basis choice. 

With a simple modification in the setup of Fig. Bob can also detect the 
presence of Eve’s faked states, which adds to the already-available security 
features due to PLM. For this. Bob creates a single pump pulse instead of a 
pair. Such a task can be accomplished by using an intensity modulator in one 
of the arms of the pump AMZI. The upconversion now takes place for only 
one of the two signal modes resulting in only two instead of three time bins. 
Moreover, the interference in the middle bin is stamped out. Due to this. Eve 
cannot control the detection outcomes using faked states. This technique can 
be used to randomly sample the quantum channel for faked state injection. 


3 Protection against various quantum hacking attacks 

In the following, we discuss in detail how the generic QKD receiver can foil 
three specific categories of attacks. At the end of this section, we also explain 
the advantages of using free-running single photon avalanche diodes (SPADs) 
over their gated counterparts for the purpose of upconverted signal detection. 


3.1 Detector control attacks 


The basic idea of detector control attacks is to exploit certain imperfections 
of the detection subsystem to control the measurement outcomes. In the last 
decade, numerous such attacks have been demonstrated on a variety of practi¬ 
cal QKD receivers 29 M| 33 3^ 60l[M] . In the case of the UCP-QKD receiver 
however, the optical gating (OG) and linear wavelength isolation (LWI) prop¬ 
erties ensure that detection events can take place only in the presence of a 
pump pulse. As explained in the previous section, this is subject to a rea¬ 
sonable extinction of the pump pulses. Assuming the pump is well isolated 
from Eve’s control, temporally advancing or delaying of Alice’s states in the 
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quantum channel 61 


rect detection events 33 


or timing dim coherent faked states to prevent incor- 
would necessarily result in a misalignment w.r.t. 


the pump, causing a severe reduction of the detection click rate. Note that the 
pump-defined temporal detection window creates a common gate for all subse¬ 
quent detectors and monitors. Attacks that use blinding light with faked-state 
pulses [M ,31 60 that have a temporal overlap with the pump pulse would be 
caught as they would lead to an observable depletion of the pump pulse; see 
Fig. 13= as an example. 

Using a single pump pulse instead of pulse pairs at random sample times, 
as mentioned previously in the implementation of NABC, can also be used 
to catch detector control attacks. With this measure, in case of normal input 
(i.e., quantum signals from Alice), the detections in DO and D1 should no 
longer bear any relation with the pump phase modulation. In other words, 
the detections become totally random. Eve’s multiphoton states - replacing 
the quantum signals during detector control attacks - would likewise become 
useless. Even more, based on the detection statistics collected during such 
checks. Bob would be able to observe a divergent pattern, such as an increased 
double click rate, thus learning about Eve’s attack. 


3.2 Wavelength-dependent behavior/Trojan-horse like attacks 


Thanks to the various properties of the UCP-QKD receiver, vulnerabilities 
arising due to the wavelength-dependent behavior of optical components such 
as fiber couplers and isolators 37 39 can be easily prevented. Eve cannot 


successfully launch an intercept and resend attack at two different wavelengths 
to exploit the starkly-different splitting ratios of a fiber coupler 


37 


since 


the SPDs are well-isolated from her injected pulses. Traditional Trojan-horse 
attacks [38l|52p^ , where Eve sends in a bright pulse into the QKD system and 
measures back-reflections that may reveal information about the basis choice, 
can also be thwartecQ There are multiple reasons that Eve cannot ascertain 
the secret basis choice of Bob: the phase of the pump is nonlinearly transferred 
onto the signal pulses and probing at Apump is prevented via LWI. The only 
wavelength not protected by LWI is the signal wavelength, and this wavelength 
is not impacted by the pump phase. 

In general, mechanisms that involve photons carrying useful information 
inadvertently leaking out of the QKD system without requiring any active 
injection from Eve are also possible. For instance, in what may be coined as 
self Trojan-horse attack, pump photons carrying information about the state 
of the PM may incur a back-reflection, say from the waveguide interface, and 
due to finite extinction/crosstalk of the DM/WDM (used as such for combining 
the signal and pump; see Fig. |3, some photons may eventually trickle out of 


® In Fig. the basis choice is implemented by a phase modulator (PM) in the pump 
arm. An optical path that allows reflection(s), carrying an imprint of the modulation, to 
propagate out of the system at least physically exists if we assume a fiber-optical wavelength 
division multiplexer (WDM) instead of the free-space dichroic mirror (DM). 
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the receiver into the hands of Eve. Alternatively, the flash induced in the single 
photon avalanche diode during breakdown may reveal information about the 
clicked detector to an eavesdropper collecting such photons on the quantum 
channel 63 . The vulnerabilities due to such mechanisms can also be drastically 
reduced by a sufflciently-large LWI. 


3.3 Laser damage attack 


Attacks aiming to permanently damaging detectors by impinging extremely 
high CW power 36 are greatly mitigated by the UCP-QKD receiver. We ex¬ 


pect that the maximum power injection levels cannot exceed a few Watts due 
to the fiber fuse effect. Assuming the ability to withstand < 10 W input optical 
power, a large attenuation of 80 dB at Apu^p (as discussed in the previous sec¬ 
tion) would relegate the power reaching the detectors to a few /xWs, which can 
be considered a safe operating condition with respect to permanent damage. 

Eve is confined to attack with high powers around Asig due to the LWI 
property. But even at this wavelength, the PLM property severely restricts the 
amount of power that eventually reaches the SPDs. To explain via a numerical 
example, assume the pump with a peak power Pout ~ 100 mW and a 10% duty 
cycle. Even with a unity efficiency conversion of the signal, the average power 
of the upconverted beam would still be < 20 mW (factor of 2 from the fact that 
Asum ~ 2Apunip)- This power is more than an order of magnitude below what 
Eve requires to inflict damage on Bob’s detectors [^. Furthermore, through 
the monitoring system at the exit of the waveguide; see Fig. Bob would 
observe not only a high depletion of the pump pulses but also a large response 
at the signal wavelength. This would clearly result in raising an alarm. 


3.4 Choice of single photon detectors 


The choice of single photon detectors can also impact the security of the QKD 
system against a variety of hacking attacks. As mentioned earlier, we consider 
Si-based single photon avalanche diodes (SPADs) that are actively quenched, 
i.e. operate in the free-running or ‘ungated’ mode. This choice is firstly reason¬ 
able because gated mode does not provide any significant improvement in the 
noise performance of Si-based single photon detectors, unlike InGaAs based 
SPADs that generally suffer from high thermal dark counts and afterpulsing if 
left ungated. Secondly, the lack of a detection gate already reduces the chances 
of many types of detector control attacks. For instance, the (temporal) detec- 

that may be exploited via the time-shift 
can be avoided. This feature also nat- 


tion efficiency mismatch loophole 64 
attack 


61 or the faked-state attack 


33 


urally precludes Eve from gaining remote access to the SPADs by attacking 
after the gate 29 , or at the falling edge of the electrical gat^ 34 . Although 


® The detector is in linear mode after the gate and displays superlinear characteristics at 
the falling edge, i.e. when it is making a transition from the Geiger mode to the linear mode. 
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Parameter name and description 

Symbol 

Value range (units) 

Temporal width, signal pulse 

Tsig 

80 — 100 ps 

Temporal width, pump pulse 

'^pum.p 

100 - 120 ps 

System repetition rate 

Jr 

1.0 GHz 

Center wavelength, signal 

Asig 

1550± 20nm 

Center wavelength, pump 

Apump 

1830± 20nm 

Center wavelength, sum 

Asnm 

830 di 10 nm 

Bandwidth, signal BPF 

^sig 

10 - 20 nm 

Bandwidth, sum frequency BPF 

'^sum 

2 — 5 nm 

Temporal separation between time 
bins corresponding to bits “0” and “1” 

5T 

300 — 400 ps 


Table 1 Values of various significant parameters in the upconversion based quantum key 
distribution (QKD) receiver shown in Fig. 


a UCP-QKD receiver equipped with gated SPADs may resist most attacks, 
the security constraints are bound to be tighter. Hence, we recommend the 
use of free-running SPADs. 


4 Overall performance and practical aspects 


In the previous sections, we have described how the UCP-QKD receiver can 
defeat a plethora of quantum hacking attacks. Tablelists the range of values 
of different parameters that have been already introduced in the last pages. 
This represents one possible design of the system. Note that many design 
alternatives are possible, such as using 2 micron pump light to reduce noise 
even further, provided they are engineered to preserve the basic properties of 
a UCP-QKD receiver, described in subsection |2.1[ 

The upconversion process can be highly efficient: values of t]c > 80% for the 
conversion efficiency, which includes the optical transmission and the in- and 
out- coupling losses through the waveguide, are viable 10 . High-performance 
detectors exhibiting large quantum efficiencies r]d ~ 80% at the upconverted 
wavelengths, low intrinsic noise characteristics D « 10 — 100 cps, and fast 
counting rates R > lOMcps are commercially available. The probability of 
successfully upconverting and detecting a quantum signal pulse at Asig is then 
given by the overall efficiency ijov = ilcVdVfl values in the range of 30 — 40% 
can be envisaged easily. Here rjf Ki 50% denotes the cumulative transmission 
of the various optical filters used for implementing LWI; see Fig.|^ 

Based on these numbers, sifted key rates of the order of 100 Kbps for ^ 
100 km channel lengths would be feasible with the first generation receivers. 
Also, by adopting measures such as long wavelength pump and strict filtering, 
the overall noise in the upconversion process can also be kept sufficiently low; 
assuming Dqv < 1 Kcps, the contribution to the quantum bit error rate would 
be under 1%. We note that for ease of implementation one can also use a 
pump source very close to the signal (e.g. 10nm [14|), where high-quality 
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modulators and amplifiers are readily available. However, this would increase 
noise and may make the implementation of LWI more difficult. 

As mentioned in the introduction, UCP-QKD is similar to MDI-QKD in 
the sense that both address vulnerabilities in the photon detection apparatus 
of realistic QKD implementations. Also, both offer realistic implementations 
with off-the-shelf components; most significantly, both allow the transmitter to 
use weak coherent states, typically realized by attenuated laser pulses, which 
are the most practical quantum signals for QKD. While only MDI-QKD claims 
a rigorous security proof against quantum hacking of the detectors, UCP-QKD 
does not share some of MDI-QKD’s stringent requirements that make the lat¬ 
ter more difficult to implement and lower the resulting key rate. For instance 
MDI-QKD implementations require indistinguishability of the weak coherent 
states generated by both Alice and Bob and they also intrinsically suffer from 
a reduced key rate due to ‘low gain’ of the single photon states 24 . Thus, 


although the two methods have fundamental differences which make a direct 
comparison difficult, roughly speaking, while MDI-QKD offers a more secure 
but lower performing system, the goal of UCP-QKD is improved security with¬ 
out a substantial reduction in performance or practicality. 


5 Conclusion 


In conclusion, we have detailed the design and operation of a novel upconver- 
sion protected (UCP) receiver for the purpose of doing secure quantum key 
distribution (QKD). We have specifically shown how Bob can use this UCP- 
QKD receiver to protect himself against various quantum hacking attacks, 
launched by an eavesdropper Eve from the quantum channel. This is possible 
because of properties intrinsic to the upconversion process that can restrict the 
degrees of freedom which Eve might have otherwise exploited to take advan¬ 
tage of the imperfections of the detection apparatus. Eve’s manipulations are 
thus either rendered futile or can be suitably monitored to raise alarms and 
abort the QKD protocol. The security features can even be combined with 
other known measures to counter attacks, such as the real time monitoring 
of the detector parameters 41 . Such UCP-QKD receivers therefore greatly 


enhance the security of practical QKD systems. With rapid advances in inte¬ 
grated photonic technologies, on-chip implementations of the waveguide and 
filtering system can minimize the optical losses even further, thereby increasing 
the key rates obtainable with such receivers. 
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